analyze-experiment

Pass

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the tpc CLI tool using a pipe-to-bash command (curl -fsSL https://cli.promptingco.com/install.sh | bash). This targets a domain associated with the skill's author to configure the necessary environment for the skill.
  • [COMMAND_EXECUTION]: The skill utilizes local shell commands to execute the tpc CLI for experiment data retrieval and uses headless Chrome or Chromium for generating PDF reports from HTML templates.
  • [EXTERNAL_DOWNLOADS]: The skill uses a CLI tool that connects to the vendor's platform to download experiment data, including signals, task results, and execution logs.
  • [PROMPT_INJECTION]: The skill processes untrusted external data (experiment transcripts and logs) to generate analysis reports, which presents a surface for indirect prompt injection.
  • Ingestion points: Data is ingested via the tpc sim run logs and tpc sim experiment results commands in SKILL.md and workflows/analyze-experiment.md.
  • Boundary markers: The instructions do not specify the use of delimiters or boundary markers when interpolating log data into the generation prompts.
  • Capability inventory: The skill has the capability to execute shell commands (tpc, google-chrome) and perform file system operations.
  • Sanitization: No explicit sanitization or validation of the ingested log content is described in the skill's workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 26, 2026, 08:32 AM
Security Audit — agent-trust-hub — analyze-experiment